FMVP: Masked Flow Matching for Adversarial Video Purification

TL;DR

FMVP introduces a novel video purification method that physically shatters adversarial structures and reconstructs clean videos using flow matching and frequency gating, significantly improving robustness against various attacks.

Contribution

The paper proposes FMVP, a new adversarial video purification technique combining physical shattering, conditional flow matching, and frequency gating, with training paradigms for known and unknown threats.

Findings

Outperforms state-of-the-art methods in robustness against PGD and CW attacks.

Achieves over 87% robust accuracy against PGD and 89% against CW.

Effective as a zero-shot adversarial detector with high AUC-ROC scores.

Abstract

Video recognition models remain vulnerable to adversarial attacks, while existing diffusion-based purification methods suffer from inefficient sampling and curved trajectories. Directly regressing clean videos from adversarial inputs often fails to recover faithful content due to the subtle nature of perturbations; this necessitates physically shattering the adversarial structure. Therefore, we propose Flow Matching for Adversarial Video Purification FMVP. FMVP physically shatters global adversarial structures via a masking strategy and reconstructs clean video dynamics using Conditional Flow Matching (CFM) with an inpainting objective. To further decouple semantic content from adversarial noise, we design a Frequency-Gated Loss (FGL) that explicitly suppresses high-frequency adversarial residuals while preserving low-frequency fidelity. We design Attack-Aware and Generalist training paradigms to handle known and unknown threats, respectively. Extensive experiments on UCF-101 and HMDB-51 demonstrate that FMVP outperforms state-of-the-art methods (DiffPure, Defense Patterns (DP), Temporal Shuffling (TS) and FlowPure), achieving robust accuracy exceeding 87% against PGD and 89% against CW attacks. Furthermore, FMVP demonstrates superior robustness against adaptive attacks (DiffHammer) and functions as a zero-shot adversarial detector, attaining AUC-ROC scores of 0.98 for PGD and 0.79 for highly imperceptible CW attacks.